CVE-2026-27478 CRITICAL

CVE-2026-27478: Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation

Vendor Unitycatalog
Product unitycatalog
Weakness CWE-290
Published March 11, 2026
Last update March 12, 2026
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (/api/1.0/unity-control/auth/tokens). The endpoint extracts the issuer (iss) claim from incoming JWTs and uses it to dynamically fetch the JWKS endpoint for signature validation without validating that the issuer is a trusted identity provider.

Key dates

02Disclosure timeline

March 11, 2026 CVE published
March 12, 2026 Record updated